about summary refs log tree commit diff stats
diff options
context:
space:
mode:
authorJune McEnroe2022-05-17 21:50:53 +0000
committerJune McEnroe2022-05-17 21:50:53 +0000
commitcc167887f1ee6907103533187ff9679f01006a1f (patch)
tree2db55698195a71d19c0cf1a6e8658cc3b6768f9a
parentBump version to 1.4.0 (diff)
downloadcgit-cc167887f1ee6907103533187ff9679f01006a1f.tar.gz
cgit-cc167887f1ee6907103533187ff9679f01006a1f.zip
Fix bad free in cgit_diff_tree
Since git commit 244c27242f44e6b88e3a381c90bde08d134c274b,

> diff.[ch]: have diff_free() call clear_pathspec(opts.pathspec)

calling diff_flush calls free(3) on opts.pathspec.items, so it can't
be a pointer to a stack variable.
-rw-r--r--shared.c12
1 files changed, 5 insertions, 7 deletions
diff --git a/shared.c b/shared.c index 8115469..0bceb98 100644 --- a/shared.c +++ b/shared.c
@@ -341,9 +341,8 @@ void cgit_diff_tree(const struct object_id *old_oid,
341 filepair_fn fn, const char *prefix, int ignorews) 341 filepair_fn fn, const char *prefix, int ignorews)
342{ 342{
343 struct diff_options opt; 343 struct diff_options opt;
344 struct pathspec_item item; 344 struct pathspec_item *item;
345 345
346 memset(&item, 0, sizeof(item));
347 diff_setup(&opt); 346 diff_setup(&opt);
348 opt.output_format = DIFF_FORMAT_CALLBACK; 347 opt.output_format = DIFF_FORMAT_CALLBACK;
349 opt.detect_rename = 1; 348 opt.detect_rename = 1;
@@ -354,10 +353,11 @@ void cgit_diff_tree(const struct object_id *old_oid,
354 opt.format_callback = cgit_diff_tree_cb; 353 opt.format_callback = cgit_diff_tree_cb;
355 opt.format_callback_data = fn; 354 opt.format_callback_data = fn;
356 if (prefix) { 355 if (prefix) {
357 item.match = xstrdup(prefix); 356 item = xcalloc(1, sizeof(*item));
358 item.len = strlen(prefix); 357 item->match = xstrdup(prefix);
358 item->len = strlen(prefix);
359 opt.pathspec.nr = 1; 359 opt.pathspec.nr = 1;
360 opt.pathspec.items = &item; 360 opt.pathspec.items = item;
361 } 361 }
362 diff_setup_done(&opt); 362 diff_setup_done(&opt);
363 363
@@ -367,8 +367,6 @@ void cgit_diff_tree(const struct object_id *old_oid,
367 diff_root_tree_oid(new_oid, "", &opt); 367 diff_root_tree_oid(new_oid, "", &opt);
368 diffcore_std(&opt); 368 diffcore_std(&opt);
369 diff_flush(&opt); 369 diff_flush(&opt);
370
371 free(item.match);
372} 370}
373 371
374void cgit_diff_commit(struct commit *commit, filepair_fn fn, const char *prefix) 372void cgit_diff_commit(struct commit *commit, filepair_fn fn, const char *prefix)